pb with "Broadcom Netxtreme Gigaethernet" NIC

[jmnogues]

Hi
Since my Sniffer is running with a "Broadcom Netxtreme Gigaethernet" NIC, I get troubles whith 2 features :
(Whith Sniffer 4.7 or 4.5 NT4 plugged on a 100 MGb Network))

1)"Expert mode" doesnt work (gives a blank page)
2) "History samples" gives low (erroneous) values (seen for multicasts and broadcasts curves)
if I use a new NIC and a new PC ==> Same problem !

(The driver used here is from HP because there is no driver available for that NIC in the Sniffer release)

However, process "Capture" seems to work properly and gives correct rates for Broadcasts/Multicasts.



Has anybody ever experimented this ?

jm

 

[phaelon56]

Your message is not entirely clear to me. Are you using Sniffer Pro? (which is Sniffer Portable - you install it on your own PC rather than buying it pre-installed on a rack mountable PC).

If it's Sniffer Pro that you're using the problem is quite simple (I think). NAi offers the Gigabit functionality on Sniffer pro only for use with the Gigabit Ultrabook accessory. This is a notebook PC sized base unit with a backplane that accepts a few different PHY modules (slide-in modules with different interfaces) including one for Gig. The Ultrabook Gig PHY module has a Gig capture card in it that actually stores the captures at or close to line rate and then streams them over a 100 mb to the PC running Sniffer Pro where they are written to disc.

If you use an unsupported card it's conceivable that some monitoring stats might possibly work although I should think that utlization levels and the like would erroneously show that they are 10x higher than they really are (if viewed as a percentage of bandwidth). This might have something to do with the skewed results in History Samples. I'm actually surprised that it works at all if the Broadcom card is not an actual capture card like the Xyratex. The Sysconnect card on Sniffer appliances is a Gig card and is supported but does not do on-card captures. it's intended for monitoring purposes only. Some people are using the Syskonnect card to do captures fro low utilization links through SPAN ports but results have been spotty - many dropped packets often result.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[jmnogues]

First , thanks for you response,
Yes this is a Sniffer PRO running on a workstation. (The previous NIC was a "INtel(R) PRO/100 VM" on which Sniffer PRO was running properly)
The network monitored is 100 or 10 Mgbit (never 1000) so I dont't need Gigabit functionality on my Sniffer.
In fact "history samples" gives values which are about 1/2 less than they should be (by instance , our broadcast rate is really about 10 or 12 frames/s , but Sniffer Monitoring and Gauge give 5 or 6 frames/s ...)

So I think the best is to ask NAI if Broadcom NIC is supported for monitoring and capture..

jm

 

[phaelon56]

The Broadcom NIC is not supported but any NIC with NDIS drivers should work okay if it's configured properly. There are a couiple of "officially supported" NIC's that are said to offer one specific advantage when the Sniffer drivers are bound to them: these cards allow visibility of Layer 1 and Layer 2 error information in Sniffer (e.g. CRC errors, runts, fragments etc.).

Once upon a time the Layer 1 and 2 error info was of great interest because we spent so much time chasing down physical layer errors on the network. Network infrastructures have improved and this is no longer the case. More significant is hte fact that most sniffing is now done through SPAN ports or mirror ports - by design theese ports do not propogate layer 1 and 2 error information. Those error packets are discarded at the switch port level and a record of them is retained int he MIB for that port. Even with the right Sniffer NIC you can see such errors only by going in-line with a tap or an in-line matrix switch.

Owen O'Neill
Datacom Systems Inc.
Northeastern SE

http://www.datacomsystems.com

 

[AZeemeri]

Hello,

The Broadcom cards do not work with SNP by default.
They are also not supported.
Think about it; Capturing gigabit traffic with a normal card without a capture buffer is a no no.
Sniffer thinks it is a gig card and will not let you work with it. Even not on 10/100.

I modified the standard Broadcom driver to let Sniffer Pro work on 10/100 level. That works good now and I have several users working with their built-in 10\100\1000 Broadcom adapters sniffing 10\100 ethernet.
It's easy; remove all gigabit references in the inf file from Broadcom (search for the text "gigabit" and delete all entries from the inf file).
Then install this driver and it should work. No guarantees, and like you say an experiment

Another thing is that this driver is not a sniffer driver so it will not report any error frames in your expert. But that is normal for a healthy nic + normal driver.

My expectation is that Network General will release a Sniffer driver for the Broadcom card in the future as this card is almost getting defacto standard for built-in nics.

 

[jmnogues]

So I have suppressed every occurence of "gigabit" from the inf file and reload the driver but the problem is exactly the same:

==> expert mode doesn't work at all (blank page) and broadcast/multicast rates are half than they should be. Capture seems to work properly

Can you confirm that "Expert mode" works correctly on your Sniffer equiped with that Broadcom NIC ?

jm

 

[AZeemeri]

Check you email ;-)

I have seen it work good yes. But remember that a nic with a non sniffer driver will not show expert symptoms/diags.
But this does not mean you get a blank screen.

And as mentioned earlier this is not supported and there are no guarantees from Network General on this.
If it doesn't work I suggest you to get a supported networkcard + snifferdriver.